CVE Vulnerability Catalog

PaperCut NG and PaperCut MF before version 22.1.3 on Windows allow attackers to perform path traversal, enabling them to upload, read, or delete arbitrary files. This can lead to remote code execution when external device integration is enabled.

Sydent, an identity server for the Matrix communications protocol, prior to version 2.5.6, did not verify SMTP servers' certificates when sending emails using TLS. This makes Sydent's emails vulnerable to interception via a man-in-the-middle (MITM) attack.

Metabase, an open-source analytics platform, prior to versions 0.43.7.3, 0.44.7.3, 0.45.4.3, 0.46.6.4, 1.43.7.3, 1.44.7.3, 1.45.4.3, and 1.46.6.4, contained a vulnerability that could allow remote code execution on the Metabase server. The issue stemmed from the ability to inject code into the connection string for the H2 database, which could lead to the execution of that code by the process running the embedded database.

The Aerospike Java client prior to versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 deserializes Java objects from server responses without proper validation. Attackers can exploit this vulnerability to inject malicious code, potentially taking control of the client machine.

Version django-sspanel v2022.2.2 was found to contain a remote command execution (RCE) vulnerability in the component sspanel/admin_view.py in the GoodsCreateView._post method.

In PHPJabbers Cleaning Business Software version 1.0, lack of verification when changing an email address and/or password on the Profile Page allows remote attackers to take over accounts.

In PHP Jabbers Class Scheduling System version 1.0, lack of verification when changing an email address and/or password on the Profile Page allows remote attackers to take over accounts.

PHPJabbers Availability Booking Calendar version 5.0 is vulnerable to User Account Takeover through username/password change.

PHP Jabbers Availability Booking Calendar version 5.0 is vulnerable to Incorrect Access Control.

PHPJabbers Availability Booking Calendar version 5.0 is vulnerable to Incorrect Access Control due to improper input validation of the password parameter.

In ai-dev aitable versions before v0.2.2, a SQL injection vulnerability was discovered in the component /includes/ajax.php.

A vulnerability in ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server. It exploits a path traversal issue in the Username field and lack of input sanitization on the SSH Key field in /base/sftpsetting/ endpoints.

Versions before 0.1.3 of the ai-dev aioptimizedcombinations library were found to contain a SQL injection vulnerability via the component /includes/ajax.php.

Dango-Translator v4.5.5 was found to contain a remote command execution (RCE) vulnerability via the component app/config/cloud_config.json.

CVE-2023-36217 is a Cross Site Scripting vulnerability in Xoops CMS v.2.5.10 that allows a remote attacker to execute arbitrary code via the category name field of the image manager function.

MotoCMS version 3.4.3 contains an SQL injection vulnerability that allows a remote attacker to gain privileges via the keyword parameter of the search function.

CVE-2023-3346 in MITSUBSHI CNC Series has a buffer overflow vulnerability that allows a remote unauthenticated attacker to cause a Denial of Service (DoS) condition and execute arbitrary code on the device by sending specially crafted packets. A system reset is also required for recovery.

A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute arbitrary commands on the hosting server.

In WS-Inc J WBEM Server version 4.7.4 before 4.7.5, the CIM-XML protocol adapter does not disable entity resolution. This allows context-dependent attackers to read arbitrary files or cause a denial of service.

A SQL injection vulnerability was discovered in ZKTeco BioAccess IVS version 3.3.1. It allows an attacker to manipulate database queries.